DAEMON Tools cdg Loader Uses a Temporary Module and first_match Key
Detects cdg.exe receiving a temporary module path together with the first_match argument used by the campaign to decrypt and execute embedded shellcode. This behavior is indicative of the DAEMON Tools backdoor.
Microsoft Sentinel (KQL)
